admin / Bid-Sentinel

"""Cyber Security keyword filters used to target relevant tenders."""

# Order matters: match_keyword() returns the FIRST entry found, so specific
# multi-word phrases are listed before short acronyms to produce the most
# meaningful "matched keyword" label. Acronyms (len <= 4) are matched with word
# boundaries (see match_keyword) to avoid false positives.
CYBER_KEYWORDS: list[str] = [
    # --- 1. Core services (specific phrases) ---
    "Managed Detection and Response",
    "Security Operations Centre",
    "Security Operations Center",
    "24x7 SOC Monitoring",
    "Incident Response",
    "Vulnerability Management",
    "Cyber Threat Intelligence",
    "Threat Hunting",
    # --- 1b. Additional high-signal cyber terms (strong; added to widen recall) ---
    "Cyber Security",
    "Cybersecurity",
    "Cyber Resilience",
    "Information Security",
    "Information Assurance",
    "Managed Security Service",  # also matches "Managed Security Services"
    "Security Operations",
    "Security Monitoring",
    "Security Testing",
    "Security Assurance",
    "Security Audit",
    "Vulnerability Assessment",
    "Vulnerability Scanning",
    "Digital Forensics",
    "Identity and Access Management",
    "Privileged Access Management",
    "Data Loss Prevention",
    "ISO 27001",
    "ISO27001",
    "SOC 2",
    "SOC2",
    # --- 2. Acronym expansions (phrases) ---
    "Cyber Security Operations Centre",
    "Extended Detection and Response",
    "Endpoint Detection and Response",
    "Network Detection and Response",
    "Security Information and Event Management",
    # --- 3. UK Government & NCSC terminology ---
    "Cyber Essentials Plus",
    "Cyber Assessment Framework",
    "CHECK Penetration Testing",
    "CHECK provider",
    "GovAssure",
    "Cyber Security Model",
    "Secure by Design",
    # --- 4. Broader technical domains (use with caution; see note below) ---
    "Penetration Testing",
    "Pen Testing",
    "Red Teaming",
    "Security Architecture",
    "Zero Trust",
    "Cloud Security",
    # --- 5. Industry acronyms & variations (word-boundary matched) ---
    "CSOC",
    "SIEM",
    "ZTNA",
    "MDR",
    "XDR",
    "EDR",
    "NDR",
    "CTI",
    "CAF",
    "CSM",
    "MSSP",
    "NIST",
    "DLP",
    "IAM",
    "SOC",
]

# Group-4 "broad" terms appear in generic IT / architecture contracts too, so a
# match on one of these ALONE is not enough: it is only treated as relevant when
# a second cyber signal is present (another keyword, a second broad term, or a
# corroborating context word). This is the AND-gate.
BROAD_KEYWORDS: set[str] = {
    "Penetration Testing",
    "Pen Testing",
    "Red Teaming",
    "Security Architecture",
    "Zero Trust",
    "Cloud Security",
}

# Corroborating cyber-context words. Deliberately excludes bare "security"
# (too generic) and any term already in CYBER_KEYWORDS (those return on their own
# before the corroboration check is ever reached).
CYBER_CONTEXT_TERMS: list[str] = [
    "cyber",
    "threat",
    "malware",
    "ransomware",
    "phishing",
    "intrusion",
    "firewall",
    "monitoring",
    "detection",
    "vulnerabilit",  # vulnerability / vulnerabilities
    "ncsc",
    "security operations",
    "endpoint",
]


def _has_cyber_context(haystack: str) -> bool:
    return any(term in haystack for term in CYBER_CONTEXT_TERMS)


def match_keyword(*texts: str | None, keywords: list[str] | None = None) -> str | None:
    """Return the matched keyword for the given text blobs, or None.

    The most specific non-broad keyword wins (phrases are listed before
    acronyms). Short acronyms (MDR, SOC, CTI) are matched with word boundaries to
    avoid false positives like "soccer" or "association". Group-4 broad terms
    (see ``BROAD_KEYWORDS``) only count when accompanied by a second cyber
    signal. ``keywords`` defaults to the built-in list; callers pass the combined
    built-in + custom list (custom keywords are always treated as strong signals).
    """
    import re

    haystack = " ".join(t for t in texts if t).lower()
    if not haystack:
        return None

    def _present(kw_l: str) -> bool:
        if len(kw_l) <= 4:  # acronym -> word-boundary match
            return re.search(rf"\b{re.escape(kw_l)}\b", haystack) is not None
        return kw_l in haystack

    broad_hits: list[str] = []
    for kw in keywords or CYBER_KEYWORDS:
        kw_l = kw.lower().strip()
        if not kw_l or not _present(kw_l):
            continue
        if kw in BROAD_KEYWORDS:
            broad_hits.append(kw)
        else:
            return kw  # strong, non-broad signal -> relevant immediately

    # Only broad terms matched -> require a second corroborating signal.
    if broad_hits and (len(broad_hits) >= 2 or _has_cyber_context(haystack)):
        return broad_hits[0]
    return None


def passes_cpv_filter(
    title: str | None,
    description: str | None,
    cpv_blob: str | None,
    *,
    cpv_terms: list[str] | None,
    strict: bool = False,
) -> bool:
    """Second-stage CPV filter, ANDed with the keyword match.

    When the user has configured CPV codes, an opportunity is kept only if one of
    those codes/descriptions appears (in the notice's structured CPV classification
    ``cpv_blob`` or its text). With no CPV codes configured the filter is open.

    ``cpv_blob`` is the notice's declared CPV classification (empty for sources
    that don't expose CPV, e.g. HTML portals). In the default (lenient) mode, a
    notice that declares NO CPV data is NOT excluded on CPV grounds — keyword
    relevance already applied, and there is no classification to judge it on. Set
    ``strict=True`` to require a CPV match from every notice regardless.
    """
    if not cpv_terms:
        return True
    haystack = " ".join(t for t in (title, description, cpv_blob) if t).lower()
    for term in cpv_terms:
        term_l = (term or "").strip().lower()
        if term_l and term_l in haystack:
            return True
    # No CPV term matched. In lenient mode, keep notices that carry no CPV data at
    # all (nothing to narrow on); in strict mode, drop them.
    if not strict and not (cpv_blob or "").strip():
        return True
    return False


def is_cyber_relevant(*texts: str | None) -> bool:
    """True if the text carries a genuine cyber-security signal.

    Uses the built-in cyber keyword list (broad terms still require corroboration),
    which is the definition of "Cyber Security related". Used as a guardrail so the
    tune-out filter can never suppress a cyber opportunity.
    """
    return match_keyword(*texts, keywords=CYBER_KEYWORDS) is not None


def matches_tuneout(
    title: str | None, description: str | None, terms: list[str] | None
) -> bool:
    """Whether an opportunity should be tuned out (hidden from scrapes/dashboard).

    An opportunity is tuned out only when it matches one of the user's tune-out
    terms AND is NOT cyber-security related. Cyber opportunities are always kept,
    no matter what is on the tune-out list — this is the hard guardrail.
    """
    if not terms:
        return False
    if is_cyber_relevant(title, description):
        return False  # never tune out anything cyber-security related
    haystack = " ".join(t for t in (title, description) if t).lower()
    if not haystack:
        return False
    for term in terms:
        term_l = (term or "").strip().lower()
        if term_l and term_l in haystack:
            return True
    return False